Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a passport of driver's license. You also check for signs that the document is not a forgery. If it all checks out, you'd let them into a bar, let them open a bank account or something like that.

Authentication is very similar. You ask for knowledge, possession and/or inherence factors to check if someone for example is allowed to log in to his e-mail or internet banking. Is there a difference between the two, and if so, what's an easy to understand explanation for it?

Edit to clarify what's confusing for me: isn't the verification of a person's identity in my example a form of authentication with a possession factor?

share|improve this question
3  
Authentication is the process via which you verify whether someone's identity is genuine or not; so you verify to authenticate. –  Lex May 31 '13 at 9:14
    
There is a very interesting technology that blurs the lines between authentication and verification. See Microsoft U-Prove –  makerofthings7 Aug 6 '13 at 21:25
add comment

3 Answers

up vote 3 down vote accepted

Let's pretend we ordered some movie tickets online, and the process of later acquiring them involves identification in person at the box office before the event. You will be asked to produce your identification document (ID). That's identification. The box office attendee will then verify your identity by visually inspecting your ID - that's identification verification. This attendee will then check against their database to verify you've purchased those tickets online, and give them to you - that's verification and you end up with an authentication token (in our case - a ticket). You will then produce those tickets before entering the theatre - that's authentication.

So in short, identification is a sub-process (integral part) of identity verification, which is a sub-process (integral part) of verification, which is a sub-process (integral part) of authorisation.

In each of these steps, you verify one set of data of the client, against another set of data of the service provider. In multi-factor authentication, this data can have different forms and/or roles, such as something the user is, something the user has, something the user knows, e.t.c., or the previous sub-process produces new set of data (or a ticket, token, nonce,...) that the next process uses to determine the outcome of its function. The level of verification, or number of times the producer's data is verified against, (or scrutiny, as @TerryChia put it), denotes how we in turn call this verification process.

TL;DR - If it involves verifying access permission, we call this verification process as authentication.

share|improve this answer
1  
Thanks! The comment by @Lex set me thinking along the same path. Successful verification that one or multiple forms of proof (ID, password, code received by SMS) are correct lead to successful authentication, giving you access to something. –  Rafe May 31 '13 at 10:46
    
Because I cannot edit my previous comment: of course you're only granted access if you're also authorized for that same something. But authentication vs authorization is already well explained on the internet :) –  Rafe May 31 '13 at 11:00
1  
@Rafe - Sure, and if you need to add authorization to the mix in the example I used, then you could say the ticket-clipping upon entering the theatre can be called that. So in a sense, the authenticator has authorized your access (you're left with a ticket clipping, so if that authorisation is ever disputed, it can be repeated and/or traced back to previous verification points). –  TildalWave May 31 '13 at 11:07
add comment

I think that the difference between the two is simply the level of scrutiny.

To verify a persons identity, requiring him to present some sort of identification like a passport or drivers license is probably enough. The word verify itself seems to suggest to me the process of tying a user account to some sort of real world identity.

To authenticate a person, identification methods through passports or drivers license might not be good enough. Those items are handled by many different people and can be forged or faked. The process of authentication might requiring the person to provide some sort of secret that should only be known to that person. Passwords are a common form of such a secret.

I have no idea about it's reliability, but this site seems to back my idea of the difference between the two.

share|improve this answer
add comment

Verify and Authentication similar but aren't the same.

In the online environment, verification simply means to "verify" the INFORMATION provided is accurate. Meaning, yes, this is a person's DOB, or Address, or password, etc. It does NOT verify the actual person, JUST the information. So, if I enter my driver's license information for "verification" you can verify that the information I provided is correct, but you can't say whether or not that I am the actual owner of the driver's license.

Authentication, on the other hand, verifies the individual. The actual person. You need at least two "verification" to authenticate. You must have two of the following: Something you know (DL information, pin/password, code word, etc.); something you have (in their possession - cell phone, smart card, HANDING you a DL, etc.); or something you are (biometrics - finger print, visual identification, etc. DL in person...)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.